kiokuko-dsh 0.2.44 → 0.2.46

package/docs/patches/dsh-latest-local-update.patch

@@ -0,0 +1,42 @@
+--- a/packages/boot/plugin-manager/src/operations.ts
++++ b/packages/boot/plugin-manager/src/operations.ts
+@@ -151,2 +151,12 @@
++/** Explicit latest for one installed local package means its registry release.
++ * Keep registry, Git, missing packages and all other pnpm forms unchanged.
++ */
++export function latestRegistryUpdate(args: readonly string[], dependencies: Readonly<Record<string, string>>): readonly string[] {
++  if (!['update', 'up', 'upgrade'].includes(args[0] ?? '') || args.length !== 3 || !args.includes('--latest')) return args
++  const name = args[1] === '--latest' ? args[2] : args[1]
++  if (!name || !/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/i.test(name) || !/^(?:file:|link:)/.test(dependencies[name] ?? '')) return args
++  return ['add', `${name}@latest`]
++}
++
+ /** Install commands that take the packages to install as positionals. */
+ const INSTALL_COMMANDS = new Set(['add', 'install', 'i'])
+@@ -313,5 +323,6 @@
+   }
+   const before = readProfileManifest('dsh', dir)
+   const savedFiles = ['package.json', 'pnpm-lock.yaml'].map(name => ({ path: join(dir, name), text: optionalFile(join(dir, name)) }))
++  args = latestRegistryUpdate(args, before.dependencies ?? {})
+   const beforeDependencies = directDependencies(before)
+   const installedBefore = new Map(Object.keys(beforeDependencies).map(name => [name, optionalFile(join(dir, 'node_modules', name, 'package.json'))]))
+--- /dev/null
++++ b/packages/boot/plugin-manager/tests/latest-local-update.spec.ts
+@@ -0,0 +1,17 @@
++import { expect, it } from 'vitest'
++import { latestRegistryUpdate } from '../src/operations.ts'
++
++it('explicit latest replaces a local profile package with its registry release', () => {
++  for (const source of ['file:/tmp/kiokuko-dsh-old.tgz', 'link:../../../checkout']) {
++    expect(latestRegistryUpdate(['update', 'kiokuko-dsh', '--latest'], { 'kiokuko-dsh': source })).toEqual(['add', 'kiokuko-dsh@latest'])
++  }
++})
++it('preserves registry updates, missing packages and non-latest or Git-pinned intent', () => {
++  for (const source of [undefined, '^0.2.44', 'git+https://example.invalid/pkg#fixed']) {
++    const args = ['update', 'kiokuko-dsh', '--latest']
++    expect(latestRegistryUpdate(args, source ? { 'kiokuko-dsh': source } : {})).toBe(args)
++  }
++  for (const args of [['update', 'kiokuko-dsh'], ['update', '--latest'], ['update', 'kiokuko-dsh', '--latest', '--recursive']]) {
++    expect(latestRegistryUpdate(args, { 'kiokuko-dsh': 'file:old.tgz' })).toBe(args)
++  }
++})

package/lisp/supervisor.mjs

@@ -2,33 +2,24 @@
 // pipe. It stays outside the worker sandbox so arbitrary Lisp cannot disable it.
 import { spawn, execFileSync } from 'node:child_process'
 import { openSync, closeSync, writeSync, readFileSync } from 'node:fs'
-import { claimRepository } from './repository-owner.mjs'
 import { processIdentity, sameProcess } from './process-identity.mjs'
 const launch = JSON.parse(process.argv[2])
-let repositoryLease
-if (launch.repositoryRoot) {
-  try { repositoryLease = claimRepository(launch.repositoryRoot) }
-  catch(error) {
-    writeSync(4, JSON.stringify({ type: 'error', code: error.message === 'REPOSITORY_IN_USE' ? 'REPOSITORY_IN_USE' : 'REPOSITORY_LOCK_FAILED' })+'\n')
-    process.exit(73)
-  }
-}
 let child, closing = false, terminationSent = false
 let namespace, terminal, finishTimer, ownershipError = false
-// Pending promises and SQLite leases do not keep Node alive after stdin EOF
-// and monitor exit. Keep unconfirmed ownership visible to the host watchdog.
+// Keep unconfirmed ownership visible to the host watchdog after stdin EOF
+// and monitor exit.
 const namespaceLifetime = launch.namespaceInfo ? setInterval(() => {}, 60000) : undefined
 const unconfirmed = message => {
   if (!ownershipError) console.error(`LISP_STOP_UNCONFIRMED: ${message}`)
   ownershipError = true
 }
-const reportRuntime = pid => {
-  if (!repositoryLease) return
+const reportRuntime = (pid, identity) => {
+  if (!launch.runtimeReport) return
   try {
-    const identity = repositoryLease.recordRuntime(pid)
-    writeSync(4, JSON.stringify({ type: 'runtime', pid, identity })+'\n')
+    const birth = identity === undefined ? processIdentity(pid) ?? null : identity
+    writeSync(4, JSON.stringify({ type: 'runtime', pid, identity: birth })+'\n')
   } catch {
-    try { writeSync(4, JSON.stringify({ type: 'error', code: 'REPOSITORY_LOCK_FAILED' })+'\n') } finally { stop() }
+    try { writeSync(4, JSON.stringify({ type: 'error', code: 'RUNTIME_IDENTITY_FAILED' })+'\n') } finally { stop() }
   }
 }
 const parentPid = pid => process.platform === 'linux'
@@ -50,7 +41,6 @@ const finish = () => {
   }
   clearTimeout(finishTimer)
   clearInterval(namespaceLifetime)
-  repositoryLease?.close()
   process.exit(terminal.signal ? 128 : terminal.code ?? 70)
 }
 const kill = () => {
@@ -120,8 +110,7 @@ if (launch.namespaceInfo) {
         }
       }
       namespace = { pid, identity }
-      // A dead bwrap monitor cannot donate a still-live namespace runtime.
-      reportRuntime(pid)
+      reportRuntime(pid, identity ?? null)
       if (closing) kill()
       finish()
     } catch { unconfirmed('invalid or unowned sandbox child report') }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kiokuko-dsh",
-  "version": "0.2.44",
+  "version": "0.2.46",
   "description": "Kiokuko plugin for DeepSeek Harness",
   "type": "module",
   "license": "MIT",
@@ -115,7 +115,7 @@
       ]
     },
     "permissions": {
-      "summary": "Kiokuko-owned local development execution, candidate memory and host receipts; normal user environment, PATH commands and child processes. Concrete confirmation for source/data deletion and durable user database changes.",
+      "summary": "Kiokuko-owned local development execution, candidate memory and host receipts; normal user environment, PATH commands and child processes. Changes within the working project directory, including deletion, replacement and project DB updates, need no extra user permission. Outside-project changes require concrete confirmation.",
       "readPaths": [
         "Configured Kiokuko SQLite database and embedding assets",
         "Registered project roots and their repository metadata",
@@ -177,7 +177,7 @@
   },
   "scripts": {
     "clean:dist": "node --input-type=module --eval \"import { rmSync } from 'node:fs'; rmSync('dist', { recursive: true, force: true });\"",
-    "build": "npm run clean:dist && tsc -p tsconfig.build.json && node scripts/build-model-transports.mjs && node scripts/compile-skill-prompts.mjs && node scripts/build-dsh-client.mjs && node scripts/build-history-codecs.mjs && node scripts/build-plugin-entry.mjs && node scripts/guardrail-artifacts.mjs --verify-bundled --quiet && node scripts/verify-micro-judge.mjs",
+    "build": "npm run clean:dist && tsc -p tsconfig.build.json && node scripts/build-model-transports.mjs && node scripts/compile-skill-prompts.mjs && node scripts/build-dsh-client.mjs && node scripts/build-history-codecs.mjs && node scripts/build-plugin-entry.mjs && node scripts/guardrail-artifacts.mjs --verify-bundled --quiet && node scripts/verify-micro-judge.mjs && node scripts/build-runtime-manifest.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "node scripts/run-tests.mjs tests/dsh",
     "test:harness": "node --import tsx scripts/run-harness-evaluation.mjs",

package/skills/kiokuko-lisp/SKILL.md

@@ -16,7 +16,7 @@ Coding: coding_workflow defines Goal/items/checks before the task Lisp choice. P
 
 Persistent: coding choice or /kioku-lisp enable. /kioku-lisp enable-task optionally selects disposable scratch evaluations. lisp_define, lisp_call and lisp_observe need no task-mode switch or Working task. Compose functions by exact dependency refs; reuse only your own protected worker, otherwise compute in private protected scratch with no repository mount or host RPC. Schemas never prove arbitrary Lisp safe. A child inherits only capabilities visible in its native scope, not the parent's task lease, heap, or result refs. Shared publication and real effects retain their approval and authority checks. ON selects Lisp computation/orchestration; direct Bash/zsh/PowerShell is rejected, even reads. Run Git/gh/builds/tests through kioku.process:run / start-job. Read/search/Skill and owned file tools remain available. Failure requires recovery or explicit /kioku-lisp disable; no silent shell fallback. Never spoof host-bound session/agent/directory/generation.
 
-Owned kioku_read/write/edit/remove/exec/result retain development receipts. Ordinary commands, investigation, builds/tests, edits and disposable artifacts need no routine confirmation. Source/data deletion and durable user DB mutation require concrete review; declare destructiveTargets. Arbitrary code effects are not exhaustively classified. Organize memory only after completion and permission; save only the exact approved content.
+Owned kioku_read/write/edit/remove/exec/result retain development receipts. Ordinary commands, investigation, builds/tests, edits and disposable artifacts need no routine confirmation. Declare destructiveTargets for known command effects. Arbitrary code effects are not exhaustively classified. Organize memory only after completion and permission; save only the exact approved content.
 
 Foreground kioku.process:run retains native Bash sandbox/approval/Stop without a memory task/Goal. Protected coding requires prototype/result inspection. Admitted workflows, owned tools and async jobs keep task/protocol authority. Use kioku.tools:call-tool/broker receipts. All workers are OS-isolated; direct Lisp/FFI cannot access workspace files or inherited credentials. Generated passed fields prove no verification. Bind task_completion conditions/source paths before checks; collect async receipts with kioku_result. Cancellation/ownership remain authoritative. Plan permits read/search/status until human approval exits at the next boundary.
 
@@ -60,10 +60,10 @@ identity/size/digest and read-only copies; other absolute paths fail. Limits: 64
 256 MiB/generation. `kioku.files:input`: read; `kioku.files:scratch`: write/unzip. Reimport
 applied files for comparison; export only when authorized. `kioku.files:propose-write`:
 relative paths, successful evaluation, durable recording.
-Development mode: ordinary replacement is authorized; deletion of source/data requires concrete confirmation. Protected compatibility mode retains its frozen-target profile policy. Duplicate targets fail;
+Changes within the working project directory, including deletion, replacement and project DB updates, need no extra user permission. Outside-project changes require concrete confirmation. Protected compatibility mode retains frozen targets and its protected-path restrictions. Duplicate targets fail;
 unchanged writes do nothing. Refusal/skip/UI failure/cancellation never authorizes.
 Trust APPLIED/UNCHANGED/NOT_APPLIED/UNKNOWN receipts; partial failure stops later writes.
-Never retry unknown effects. Use owned tools for ordinary project files and confirmed durable DB changes; protected compatibility mode refuses its protected paths/databases/links and recursive deletion. Independent backups never auto-prune. RUNNING lasts until
+Never retry unknown effects. Use owned tools for working-project files and project DB updates; protected compatibility mode refuses its protected paths/databases/links and recursive deletion. Independent backups never auto-prune. RUNNING lasts until
 receipts save; restart repairs finalization without reapplying effects.
 
 ## Programs, verification and packages
@@ -185,7 +185,7 @@ Native tool schemas remain authoritative for exact arguments.
   captured bytes in private scratch and runs an approved host verifier. Observe
   all required files, including `package.json`; missing dependencies/scripts
   fail or return NOT_APPLIED. `testStatus:unknown` is not a passing test.
-- `lisp_apply`: `{operationId, candidateRef, verificationRef?}` uses owned execution in development mode and concrete approval for destructive changes; it rechecks the read set and frozen targets, and accepts only a successful
+- `lisp_apply`: `{operationId, candidateRef, verificationRef?}` uses owned execution in development mode without extra approval for local changes; it rechecks the read set and frozen targets, and accepts only a successful
   verification receipt for the same candidate. Without one, it reports `not-run`.
 - `lisp_compare`: `{operationId, leftRef, rightRef}` compares saved bases and
   operation/content hashes without executing either candidate.
@@ -349,11 +349,11 @@ shortlist order for selection; source and test for diagnosis. Define `obj` first
 <!-- kiokuko:documentation approval-help -->
 ## Development approval policy
 
-Project edits, verification, helper compilation/registration and ordinary Kioku storage are authorized. Source/data deletion and durable user DB mutations need a concrete review, regardless of the legacy lisp.approvalMode ask/auto value. Old profile settings still load. Do not request conversational permission before a required host review. Refusal, cancellation, stale targets and uncertain outcomes remain authoritative; never replay effects.
+Project edits, verification, helper compilation/registration and ordinary Kioku storage are authorized. Changes within the working project directory, including deletion, replacement and project DB updates, need no extra user permission. Outside-project changes require concrete confirmation. Legacy lisp.approvalMode ask/auto does not add confirmation for local files. Old profile settings still load. Do not request conversational permission before a required host review. Refusal, cancellation, stale targets and uncertain outcomes remain authoritative; never replay effects.
 
 <!-- /kiokuko:documentation -->
 <!-- kiokuko:runtime approval-policy -->
-Routine development and helper registration are authorized. Concrete destructive review remains required. Lisp failure retains the selected shell route. Report execution, verification and saving separately; retry saving without replaying effects.
+Routine development and helper registration are authorized. Lisp failure retains the selected shell route. Report execution, verification and saving separately; retry saving without replaying effects.
 <!-- /kiokuko:runtime -->
 
 

package/skills/kiokuko-soul/SKILL.md

@@ -8,16 +8,16 @@ description: Kiokuko's entry router for non-trivial DSH work. Read it before any
 <!-- kiokuko:runtime contract -->
 # SOUL router
 
-Read first. Host owns intake/session/capabilities/routing/delegation; absent task_prepare/task_answer is normal. Require ready/exhausted and permissive nextAction; invent no profile.
+Read first. Host owns intake, identity, capabilities and routing; require ready/exhausted and permissive nextAction. Never invent a profile.
 
-User instructions outrank Skills. Preserve identity/revisions/leases/integrity and Plan/goal/cancellation/ownership. Optional enrichment never vetoes work. Use authorization/evidence for routine choices; clarify unclear intent/destruction. Finish, report blockers, recheck changes; no invented budgets.
+User instructions outrank Skills. Preserve identity, revisions, leases, Plan, cancellation and ownership. Optional enrichment never vetoes work. Clarify unclear intent or destructive effects; finish, verify and report blockers.
 
 **本当に、それを全部計算・保存・検索する必要があるのか？**
 Preserve results: eliminate needless computation/storage/search, narrow scope, then optimize. Justify exhaustive work. Never silently approximate/delete data or waive validation, recovery or audit. No extra approvals/artifacts.
 
-Choose request-relevant Skills; non-code needs no coding startup. Read indexes and risk-relevant references. Preserve roles/exclusions/recovery and host outcomes/model/effort.
+Read relevant Skill indexes and risk-selected references; non-code needs no coding startup. Preserve roles, exclusions and recovery.
 
-Use current model/memory/Skills and kioku_read/write/edit/remove/exec/result. Project work, PATH/bash/zsh, Lisp and builds/tests are authorized; review source/data deletion and durable user DB changes concretely. Recover Lisp or explicitly change route. Pre-bind source/test/config checks; collect final background receipts. Receipts establish observations only; check recalled candidates against current sources. Report work, verification and memory saving separately. After completion, get permission to organize memory; show the exact proposal and save only its user-approved revision. Comments need new previews; decline saves nothing. Memory failure never blocks work. Reconcile uncertain approved saves with the original key; never replay work or invent save identities. Human implementation requests or Plan approval request exit at the next accepted boundary; plan-only answers stay in Plan.
+Use current model/memory/Skills and kioku_read/write/edit/remove/exec/result. Changes within the working project directory, including deletion, replacement and project DB updates, need no extra user permission. Outside-project changes require concrete confirmation. PATH/bash/zsh, Lisp and builds/tests remain authorized; native permissions and integrity checks still apply. Recover Lisp or explicitly change route. Pre-bind source/test/config checks; collect final background receipts. Receipts establish observations only; check recalled candidates against current sources. Report work, verification and memory saving separately. After completion, get permission to organize memory; show the exact proposal and save only its user-approved revision. Comments need new previews; decline saves nothing. Memory failure never blocks work. Reconcile uncertain approved saves with the original key; never replay work or invent save identities. Human implementation requests or Plan approval request exit at the next accepted boundary; plan-only answers stay in Plan.
 
 Without Skills, use current evidence within host identity/authority/integrity; never substitute required Skills or auto-install/execute fetched ones. Claim no unread Skills or unrun checks. Check supported file types before diagnostics; manually check Markdown/unsupported documents for structure, requirements and whitespace. Unavailable diagnostics stay unverified. After each successful edit/write, re-read before the next mutation; reconcile stale content and never force overwrites. Never repeat unsupported diagnostics unchanged.
 

package/lisp/repository-owner.d.mts

@@ -1 +0,0 @@
-export function claimRepository(root: string): { recordRuntime(pid: number): string | null; close(): void }

package/lisp/repository-owner.mjs

@@ -1,58 +0,0 @@
-// The existing supervisor holds this OS-backed SQLite lock until its runtime exits.
-// The user directory is independent of DSH's DB, session and worker TMPDIR.
-import { DatabaseSync } from 'node:sqlite'
-import { createHash } from 'node:crypto'
-import { lstatSync, mkdirSync, realpathSync, readFileSync, writeFileSync, renameSync, unlinkSync } from 'node:fs'
-import { randomUUID } from 'node:crypto'
-import { processIdentity, sameProcess } from './process-identity.mjs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-export function claimRepository(root) {
-  const canonical = realpathSync(root)
-  const directory = join(process.platform === 'win32' ? tmpdir() : '/tmp', `kiokuko-lisp-owners-${process.getuid?.() ?? 'user'}`)
-  mkdirSync(directory, { recursive: true, mode: 0o700 })
-  const info = lstatSync(directory)
-  if (!info.isDirectory() || info.isSymbolicLink() || (process.getuid && info.uid !== process.getuid()) || (info.mode & 0o077))
-    throw new Error('REPOSITORY_LOCK_DIRECTORY')
-  const path = join(directory, `${createHash('sha256').update(canonical).digest('hex')}.sqlite3`)
-  try { const file=lstatSync(path);if (!file.isFile() || file.isSymbolicLink()) throw new Error('REPOSITORY_LOCK_FILE') }
-  catch(error) { if(error.code !== 'ENOENT') throw error }
-  const db = new DatabaseSync(path)
-  const metadata=path+'.owner.json',token=randomUUID()
-  try {
-    // Opening a new SQLite file briefly takes reader locks in *both* contenders.
-    // A zero busy timeout can make both exclusive acquisitions fail before
-    // either owns the repository. Allow those short initialization reads to
-    // drain; an existing owner's lifetime transaction still rejects in 250ms.
-    db.exec('PRAGMA busy_timeout=250; BEGIN EXCLUSIVE; CREATE TABLE IF NOT EXISTS repository_owner(root TEXT NOT NULL)')
-    try {
-      const owner=JSON.parse(readFileSync(metadata,'utf8'))
-      if(!Number.isSafeInteger(owner.pid)||owner.pid<1||owner.root!==canonical||typeof owner.token!=='string'
-        ||owner.identity!==null&&!/^[a-f0-9]{64}$/.test(owner.identity))throw new Error('REPOSITORY_LOCK_METADATA')
-      // A supervisor killed before cleanup must not donate its still-live runtime.
-      if(sameProcess(owner.pid,owner.identity??undefined))throw new Error('REPOSITORY_IN_USE')
-    } catch(error) { if(error.code!=='ENOENT')throw error }
-    db.prepare('DELETE FROM repository_owner').run()
-    db.prepare('INSERT INTO repository_owner VALUES(?)').run(canonical)
-    let recorded=false
-    return {
-      recordRuntime(pid){
-        const temporary=metadata+'.'+token
-        const identity=processIdentity(pid)??null
-        writeFileSync(temporary,JSON.stringify({root:canonical,pid,identity,token})+'\n',{flag:'wx',mode:0o600})
-        renameSync(temporary,metadata);recorded=true
-        return identity
-      },
-      close(){
-        // Called only after runtime exit. A crash leaves evidence for the next owner.
-        if(recorded){const owner=JSON.parse(readFileSync(metadata,'utf8'));if(owner.token===token)unlinkSync(metadata)}
-        db.close()
-      },
-    } // Transaction stays uncommitted; the OS releases it when this supervisor dies.
-  } catch(error) {
-    db.close()
-    if(error.errcode === 5 || error.code === 'SQLITE_BUSY') throw new Error('REPOSITORY_IN_USE')
-    throw error
-  }
-}